Welcome to Walla, a service provided by Paprika Data Lab Inc. ("Company", "Walla", "we", "us", or "our"). We are committed to protecting your privacy and ensuring a secure experience.
This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website, use our survey platform, and interact with our services (collectively, the "Service").
1. Important Note on Our Roles (Controller vs. Processor)
To understand your privacy rights, it is critical to distinguish between our two legal capacities:
Walla as a Data Controller: When you create an account, purchase a subscription, or navigate our website, we act as a Data Controller for your account and usage information.
Walla as a Data Processor: When you (our "Member") create surveys and collect responses from individuals ("Respondents"), you act as the Data Controller, and Walla acts strictly as a Data Processor/Service Provider. We process Respondent Data solely on your documented instructions and in accordance with our Terms of Service. This Privacy Policy does not govern how our Members use the data they collect through our platform.
2. Information We Collect
We collect information that identifies, relates to, or could reasonably be linked with you.
A. Information You Provide to Us
Account Data: When you sign up via Google OAuth, we collect your Google email address, nickname, and profile picture. You may optionally provide institution or organization information.
Billing Information: For Paid Services, transaction and payment data are collected. This information is processed directly and securely by our payment gateway provider (Stripe) and is not stored on our servers.
B. Information Collected Automatically
System and Usage Logs: IP address, browser type, device information, operating system, access dates/times, and automated error/crash logs.
Cookies and Tracking Technologies: We use cookies and similar tools to maintain session states, understand user preferences, and optimize platform performance.
C. Third-Party Integrations
Google API Data: Walla complies with the Google API Service User Data Policy. Data retrieved from Google accounts is exclusively used for essential account provisioning (login, registration, profile creation) and is never used for secondary monetization or advertising.
OpenAI GPT Features: If you utilize our AI-powered features (e.g., open-ended response text analysis), certain text inputs may be transmitted to OpenAI, Inc. for processing. This data is handled in accordance with OpenAI's API privacy safeguards and is not used to train public AI models.
3. How We Use Your Information & Lawful Bases (GDPR)
If you are located in the European Economic Area (EEA) or the United Kingdom (UK), we only process your personal data when we have a valid legal basis under GDPR Article 6:
Purpose of Processing | Categories of Data | Lawful Basis (GDPR) |
|---|---|---|
Account Creation & Authentication: Verifying your identity and setting up your workspace. | Account Data (Email, Nickname, Profile Pic) | Performance of a Contract |
Service Delivery & Billing: Processing payments, issuing invoices, and providing platform features. | Account Data, Billing Data | Performance of a Contract |
Customer Support & Error Resolution: Reviewing logs to fix software bugs and answering user inquiries. | System Logs, Support Tickets | Legitimate Interests (To maintain a stable platform) |
Platform Promotion & Social Proof: Highlighting your public usage, publishing customer success stories, and displaying customer references on our blog and landing pages. | Corporate Name, Logo, Authorized Representative's Professional Contact Info/Testimonials | Legitimate Interests (Walla's legitimate business interest in marketing and demonstrating service efficacy) OR Consent (for in-depth personal interviews) |
Marketing & Enhancements: Sending feature updates, newsletters, and analyzing platform usage trends. | Usage Logs, Cookies | Consent (Where required by law, fully withdrawable) |
4. How We Share Your Information
Walla does not sell your personal information. We do not trade, rent, or disclose your personal data to third parties for their own commercial or marketing purposes.
We only share personal data with trusted third-party service providers ("Sub-processors") who perform essential operational functions on our behalf. These vendors are bound by strict data processing agreements:
Google Cloud Platform (GCP): Cloud infrastructure and database hosting.
Cloudflare, Inc.: Network security, Content Delivery Network (CDN), and DDoS protection.
Stripe, Inc.: Payment processing and secure merchant services.
OpenAI, Inc.: Sub-processing of specialized AI analytics functionality. Note: We may disclose information if required to do so by valid legal processes (e.g., a court order or subpoena) or to protect the safety, rights, and property of our users or the public.
5. International Data Transfers
Walla operates globally, and our primary servers are located in South Korea.
EU-South Korea Adequacy Decision: For users in the EEA/UK, transfers of personal data to South Korea are legally secured by the European Commission's formal Adequacy Decision for South Korea, recognizing that South Korean law provides a level of data protection equivalent to the GDPR.
Other Global Transfers: For transfers to sub-processors in third countries (such as Stripe or OpenAI in the United States), we rely on recognized lawful transfer mechanisms, including the European Commission's Standard Contractual Clauses (SCCs).
6. Data Retention and Destruction
We retain your personal data only as long as necessary to fulfill the purposes outlined in this policy or to comply with statutory legal requirements:
Account Data: Retained until you formally close or delete your account workspace.
Automated System Logs: Typically deleted or fully anonymized within 3 to 6 months.
Legal Statutory Retention: Transaction records and consumer dispute files may be retained for 3 to 5 years where dictated by local electronic commerce regulations. When personal data is no longer required, digital files are permanently deleted using secure overwrite techniques to prevent data recovery, and physical records are shredded or incinerated.
7. Your Global Privacy Rights
A. Your Rights Under the GDPR (EEA & UK Users) If you reside in the EEA or UK, you possess the following rights regarding your personal data:
Right of Access & Portability: Request a copy of your personal data in a structured, machine-readable format.
Right to Rectification: Request the correction of inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): Request the permanent deletion of your data under certain conditions.
Right to Restriction & Objection: Object to or restrict certain types of data processing, such as direct marketing.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.
Right to Lodge a Complaint: You have the right to complain directly to your local Data Protection Authority (DPA).
B. Your Rights Under the CCPA/CPRA (California Residents)
If you are a California resident, you have specific rights under the California Consumer Privacy Act:
Right to Know/Access: Request details regarding the categories and specific pieces of personal information we have collected about you over the past 12 months.
Right to Delete: Request the deletion of personal information collected from you.
Right to Correct: Request the rectification of inaccurate personal information.
Right to Non-Discrimination: We will not discriminate against you (e.g., deny service or alter pricing) for exercising your privacy rights.
No Sale or Share Declaration: Walla does not "sell" your personal information, nor do we "share" your personal information with third parties for cross-context behavioral advertising. Therefore, we do not display a "Do Not Sell or Share My Info" link on our platform. To exercise any of these rights, please contact us using the details in Section 9 below. We will verify your identity before processing the request.
8. Children’s Privacy
Our Service is intended strictly for a general audience and is not directed at children. We do not knowingly collect personal information from individuals under the age of 13 (or under 16 in certain European jurisdictions). If we discover that a child has provided us with personal data without verifiable parental consent, we will take immediate steps to purge that data from our infrastructure.
9. Contact Us & Data Protection Officer
If you have any questions, concerns, or wish to submit a privacy rights request, please reach out to our privacy management team:
Company Name: Paprika Data Lab Inc.
Chief Technology Officer / Data Protection Officer: Youngbum Kim
Privacy Inquiries & Support Email: [email protected]
General Corporate Correspondence: [email protected]
